Posted
by
Unknown Lamer
on Monday September 17, 2012 @05:25PM
from the die-ie-die dept.

wiredmikey writes "A new zero-day vulnerability affecting Internet Explorer is being exploited in the wild affecting IE 9 and earlier. The vulnerability, if exploited, would allow full remote code execution and enable an attacker to take over an affected system. Security researcher Eric Romang discovered the vulnerability and exploit over the weekend while monitoring some infected servers said to be used by the alleged Nitro gang. To run the attack, a file named 'exploit.html' is the entry point of the attack ... According to analysis by VUPEN, the exploit takes advantage of a 'use-after-free vulnerability' that affects the mshtml.dll component of Internet Explorer. Rapid7 on Monday released an exploit module for Metaspolit which will let security teams and attackers alike test systems."

We should take a page from the book of the mod_security team and add "exploit.html" to our list of URL filters. Make sure your AV software is also set to block "virus.exe" from running.

The mod_security reference is about the fact that they block files called "shell.php" from running, as if blocking specific filenames equals security. We had a hard time figuring out why the servers were refusing to acknowledge the existence of the PHP scripts that were launching our courseware shells.

Clearly we should stop supporting all browsers before IE12 and Firefox 39725.1

Unless I'm mistaken, IE is the only browser to ever be vulnerable to a drive-by (please correct me if I'm wrong). I thought with W7 MS had pretty much gotten its act together in regards to security and software bugs, but I guess I was wrong about that.

Completely wrong, as it happens, although I'm honestly not sure how you could have gotten that idea. Drive-by exploits, in the sense of "you visit a website and are pwned", have existed for all major browsers.

Microsoft has taken IE security pretty seriously and has established a pretty darn good track record with IE7->9 so far, at least on ASLR enabled platforms. I am surprised to see a reliable exploit that can be implemented as a drive-by on otherwise current platforms. This going to be a big deal and likely force an off cycle patch.

Almost every major browser in use has had a vulnerability. Those that haven't are vulnerable because of commonly-used plugins. It's not just IE9, it's browsers in general... it's the repeated and systemic perversion and added complexity of trying to turn the web into the end-all and be-all of the internet. When it was created, the uses for it were not as complicated as they are now.

It's the complexity of the web that is its vulnerability -- I honestly don't think there's a way to write a truly-secure web browser because everything from the protocols up have been shoehorned into things they were never designed to do. The entire thing needs to be jettisoned -- html, css, xml, http, ssl, everything. We need to start over from scratch, and build a new set of protocols and specifications, not just continually band-aid over existing ones. And this time, security needs to be a design consideration from the start, not evolved in.

Anyone with an understanding of information systems' security will tell you -- security needs to be built in from the start or it doesn't matter how much effort you put in later, you're going to be chasing down problems forever. Start with a secure and vetted design and it's a lot more likely to perform. Of course, real security would mean that governments, corporations, and other interested parties wouldn't be able to snoop on what you're doing -- anything sent in the clear can be screwed with. Oh... and it wouldn't be as convenient as it is today; You'd have to think about what you were doing, instead of blithering about and when you get "hacked" blaming everyone but yourself.

Real security would mean no more excuses... from anyone. That's why you won't exactly be seeing a parade down main street anytime soon congratulating people on making computers more secure; Responsibility? Not on MY internet!

The entire thing needs to be jettisoned? Start over from scratch? The odds of that happening to the web are about the same as the odds of that happening with the government. It sounds good, but it's far from practical.

Running web browsers in a well-written sandbox with only very careful access to "the outside machine" will help keep browser bugs from turning into system-wide vulnerabilities.

Sure, someone may take over your browser and turn it into DNS-generation-engine, but once you quit your browser, anything left over will require a social-engineering attack ("download catpics.exe and after you quit your browser, run it!") to continue living.

First of all, there can be bugs in the runtime that lead to possible exploits. I have a friend who manages to generate segfaults in Java about once every two weeks (no idea how many of them are the same bug being hit multiple times; maybe all of them). In case you're confused, a segfault (as opposed to a NullPointerException) means the runtime thought it could access the memory there, after running all its checks... and found out otherwi

Yeah, I put this right beside those users that posted to tell me "Oh IE isn't fragmented, you just have to buy the latest OS to use it!" wow, really? No shit.

The sad part is I at this point really don't have much in the way of sympathy anymore for anyone using IE and getting boned. this is like a dog walking out in front of a car and getting hit again and again, sooner or later you just figure its Darwin's way of thinning the herd of the dumbasses in the breed.

but every. single. time. I've had a user tell me they have "A problem with Internet explorer" I open the thing up and its got more toolbars and other malware bullshit than you can even count, anybody stupid enough to use IE while the spyware and toolbars and other shit just keeps piling up deserves what they get.

Heh, a friend told me the other day he broke his monitor with his mouse; his XP PC had slowed to a crawl after he let his daughter in law use it. I looked at it for him, it was full of useless crud

Easy way to get them off IE, without having to resort to Kubuntu (which is a BAD idea unless you want to be their 24/7/365 tech support BTW, because they'll drive you batshit wanting some Windows this or that software to run or because something is "acting funny" which is actually its default behavior and just different) is to give them Comodo Dragon with ABP and the ForecastFox extensions.

This way they have a browser that's fast like Chrome but with no phone home, if you take the default option that has th

Compromised ad servers seem to happen often enough still. People have in not so recent past gotten infected from not so dangerous sites such as CNN.com.

Some sites are such morasses of server calls to other places all jumbled in one page it defies description. True, someone visiting the same four sites is going to be OK, but someone visiting Facebook (as an example) may very well be exposed.

of shoddy browser security. Could this not be "solved" with proper sandboxing? If there's legacy code to support (this has been cited many times in the past for reasons why), please, please fork IE into two branches: IE Classic or whatever that's fully backwards compatible, and an IE Lite that's completely sandboxed and locked down for wide-spread corporate deployment.

And it is that "legacy support" that is causing half the problems of Windows. It's never good to support legacy, at least, not without very careful consideration. Considering sandboxing though, it might just be alright to have all the legacy stuff in a VM-like environment entirely and have your host system be something a lot more stable.
That just sounds like having linux host + windows guests though.

Why the hell would you do it that way? All major OSes, including NT (XP, Vista, Windows *, Windows Server *), have the ability to *automatically* run a program as a specific user, even if that user is different from the user that launched the program. On POSIX systems, this is enshrined in the filesystem permission bits; setUID and setGID.

Win8 actually does this for apps installed from the Marketplace. Each one gets a new, unique SID (security identifier, essentially a user account except without things lik

Actually there have been 30+ exploits in Firefox between 3.6 and the current release over the year and a half!

They are everywhere and nupen came to fame earlier this year from cracking Chrome. It is not a design flaw per say as IE 9 is sanboxed. It is hard when you have JIT javascript, flash, and java which job is to ACTUALLLY EXECUTE on the given platform.

According to the exploit it needs flash or java to spray the sandbox heap until the sandbox eventually gets compromised. So that is the problem right the

MS sucks in many areas in their browsers but recently they have redeamed themselves in this area. Firefox is a joke in comparison and was so bad adobe had to make a custom version of flash taht was sandboxed. Chrome already had both sandboxed

This exploit has been targeting chem and defense companies. The thing about these exploits is that they typically are just a method to drop the actual payload which is usually a virus or trojan. In this case it looks like the payload is Poison Ivy, which was added to NOD32 AV defs back in 2008. Yes, the attacker could compromise the machine and get admin shell, but the majority of the time they’re installing a keylogger or other virus which NOD32 will catch.

From TFA:

First, a file named “exploit.html” appears to be the entry point of the attack, which loads “Moh2010.swf”, an encrypted Flash file that it decompress in memory.

According to AlienVault's Jaime Blasco, the payload dropped is Poison Ivy, as was the case with the previous Java zero-day. Poison Ivy is a remote administration tool (RAT) that was used the Nitro attacks that targeted chemical and defense companies.
Interestingly, after exploitation, the attack loads “Protect.html”, a file that checks to see if the Web site is listed in the Flash Storage settings, and if it is, the Web browser will no longer be exploited despite additional visits to the malicious site.

A Zero Day exploit is one that has not been released to the public or manufacturer. There are 0 days of public awareness of the exploit. Once released it's Day 1, and that counter increments until the exploit is fixed.The term has since changed, and now a 0-day seems to be any unpatched vulnerability, no matter how long the public/manufacturer have been aware of it.Under the old definition (which actually makes sense) news about a 0-day is impossible, since once it's in the news it's not a 0-day anymore. Th

Yes I RTFA and didn't see any information on whether IE9-64 is affected. Pretty lousy of the tester to not bother indicating if the problem is only with the 32bit version as the 64bit has a better baseline security configuration. Due to these issues, it's just one of the reasons I also use Palemoon64. Improved security such as full ASLR along with DEP support so I'm hopefull this does not affect IE9-64 due to the limited number of folks actually using it.

PC stands for "Personal Computer" and macs are PCs. Some PCs get viruses... the ones running Windows. Any computer can be trojaned or taken over by other social engineering, but Windows is the only OS prone to drive-by infections.

There are also actually some useful features of IE that no other browser has be default (there are halfway-there implementations of some in Firefox extensions, and full implementations of a few others). I use IE, Firefox, and Chrome on a daily basis (Opera and Safari are also installed but rarely get used). For example, I prefer the built-in tab management in IE over both of the others, although I'm a little annoyed that they disabled Quick Tabs by default in IE9 (easy to restore it though). This is one are

Does this exploit work if you're running a modern Internet security suite such as the new Norton Internet Security 2013 with all anti-malware definitions up to date? Mind you, my default web browser on my desktop and laptop is Google Chrome 21.0.1180.89, the current "stable" release version.

I'm sure once the anti-malware vendors update their signatures in a few days they will detect it, but for now its fair game. The problem with anti-malware/anti-virus software as that they are purely reactive, they really don't help much against zero-day attacks.

I'd almost agree, but most companies that sell Internet security software update their definitions many times a day around the clock. In fact, in Norton Internet Security 2013 on my desktop and laptop computers, the updates occur at least 7-8 times per days for the latest anti-malware definitions.

I don't know what they are updating, but they certainly are not pushing signature updates 7-8 times a day. Not enough new threats come out every day to warrant that kind of update cycle.

FWIW, I don't even see an official product page for the "2013" version, which makes me think you might be running a trojan and the 2012 version only updates every few days [symantec.com], which is typical.

I'm running the 2013 version, given it was directly downloaded from Symantec's own web site.:-) The release version (which came out a week ago) is 20.1.1.2. In fact, I found out that NIS 2013 can do "pulse" updates of anti-malware definitions about 2-3 rimes per hour.

This exploit gains the privileges of the running user on Windows Vista and 7. The entire point of all the "allow/deny" popup BS with UAC was because they wanted to restrict processes to the lowest privilege necessary. IE is supposed to be a high-risk, sandboxed application and yet this exploit magically gets around it and gains access to the full user's account, which probably has admin rights on the machine.
MS does not understand security. You don't start out by giving a user admin rights, you make th

I wonder, given many people here are convinced it's a dying product, why a story like this makes the front-page? Either IE is popular so news like this is important, or IE is a side-lined product that has no relevance...it seems that narrative changes depending on if the news is good or bad.

I find it curious we rarely hear about new major product releases from MS, but the second there's a vulnerability it's the top story. Are we interested in IT or just IT that isn't MSFT tech? There's a difference.